A Security Risk Taxonomy for Commercial Space Missions

Falco, Gregory; Boschetti, Nicolò

doi:10.2514/6.2021-4241

Cited by 19 publications

(7 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The figure summarizes our satellite firmware threat insights to provide a compact and functional overview. Previous work by Falco and Boschetti [21] provides a broad taxonomy of general threats against satellites, including environmental, physical, and digital-cyber-technical risks. The latter serves as our high-level attacker goals such that our works integrate well with their taxonomy.…”

Section: Satellite Firmware Threatsmentioning

confidence: 99%

See 1 more Smart Citation

Space Odyssey: An Experimental Software Security Analysis of Satellites

Willbold,

Schloegel,

Vögele

et al. 2023

2023 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Satellites are an essential aspect of our modern society and have contributed significantly to the way we live today, most notable through modern telecommunications, global positioning, and Earth observation. In recent years, and especially in the wake of the New Space Era, the number of satellite deployments has seen explosive growth. Despite its critical importance, little academic research has been conducted on satellite security and, in particular, on the security of onboard firmware. This lack likely stems from by now outdated assumptions on achieving security by obscurity, effectively preventing meaningful research on satellite firmware.In this paper, we first provide a taxonomy of threats against satellite firmware. We then conduct an experimental security analysis of three real-world satellite firmware images. We base our analysis on a set of real-world attacker models and find several security-critical vulnerabilities in all analyzed firmware images. The results of our experimental security assessment show that modern in-orbit satellites suffer from different software security vulnerabilities and often a lack of proper access protection mechanisms. They also underline the need to overcome prevailing but obsolete assumptions. To substantiate our observations, we also performed a survey of 19 professional satellite developers to obtain a comprehensive picture of the satellite security landscape.

show abstract

Section: Satellite Firmware Threatsmentioning

confidence: 99%

“…Control Layer. We model the high-level attacker goals against the Satellite based on the final digital-cybertechnical risks Falco and Boschetti identified [21]. Then, we identify intermediate goals an attacker must achieve towards their final goal and differentiate between two target components, the Bus and the Payload .…”

Section: Threat Taxonomymentioning

confidence: 99%

Space Odyssey: An Experimental Software Security Analysis of Satellites

Willbold,

Schloegel,

Vögele

et al. 2023

2023 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…These systems may encounter threats from a wide range of sources. Space threats can be classified into four categories kinetic physical, non-kinetic physical, electronic, and cyber threats (Harrison et al, 2020;Falco and Boschetti, 2021). Kinetic physical threats refer to the weap-ons which can directly strike or detonate a space system, including ballistic and nuclear missiles.…”

Section: Threats To Teleoperated Robot In New Spacementioning

confidence: 99%

“…Non-kinetic physical threats contain direct-energy weapons which can physically damage or prevent the operation without physical contacts. These could be lasers, high-powered microwave weapons, and electromagnetic pulse weapons, which can have physical effects on satellites and ground stations (Suloway et al, 2020;Falco and Boschetti, 2021).…”

Section: Threats To Teleoperated Robot In New Spacementioning

confidence: 99%

Challenges in threat modelling of new space systems: A teleoperation use-case

Sheik

Atmaca

Maple

et al. 2022

Advances in Space Research

View full text Add to dashboard Cite

“…As a result, previously unrealistic attacker models become increasingly likely. With these ongoing changes, efforts to ensure a secure and protected access to satellites grow, as attackers may attempt to exploit vulnerabilities in satellite firmware [3].…”

Section: Introductionmentioning

confidence: 99%

A Case Study on Fuzzing Satellite Firmware

Scharnowski,

Buchmann,

Wörner

et al. 2023

Proceedings 2023 Workshop on Security of Space and Satellite Systems

View full text Add to dashboard Cite

Satellites perform critical functions of our modern digital infrastructure, such as providing communications, navigation, and earth observation services. Maintaining a satellite requires remote access, so securing that access is an essential aspect of developing and operating a satellite. While satellites have traditionally not been subjected to regular attacks, this might not hold in the future. Hence, securing satellite firmware-the software that controls the space segment of satellite missionsbecomes increasingly relevant.In this work, we perform a case study of applying recent embedded firmware analysis techniques to satellite payload data handling systems. We explore whether FUZZWARE, a state-of-theart firmware fuzz testing system, can be used to these firmware images. During this case study, we also describe and apply the process of manually optimizing FUZZWARE configurations for firmware targets, and measure the impact of different optimizations. Finally, we identify challenging aspects of fuzz testing satellite firmware and directions for future work to optimize fuzz testing performance in a fully automated manner. As part of our case study, we identified and responsibly disclosed 6 bugs in 3 satellite firmware images.

show abstract

A Security Risk Taxonomy for Commercial Space Missions

Cited by 19 publications

References 0 publications

Space Odyssey: An Experimental Software Security Analysis of Satellites

Space Odyssey: An Experimental Software Security Analysis of Satellites

Challenges in threat modelling of new space systems: A teleoperation use-case

A Case Study on Fuzzing Satellite Firmware

Contact Info

Product

Resources

About